Whats hot...IPSec is hot.  I've been playing around over the past few days on scripts that setup IPSec rules to protect a Windows 2000 or XP system.  Now IPSec has two modes - AH and ESP.  AH provides authentication of packets while ESP provides encryption of packets.  You can use both at once but its a little different then the perfect security option you would think.

IPSec has performance concerns.  It causes an increase in bandwidth and CPU usage.  Not so big on a home network, but in a corporate environment it can be noticeable.

  I've extended this IPSec learning to enable IPSec security (AH+ESP) on my home network for all traffic.  I haven't noticed any performance issues.  I tend to do very little between my computers.

How to use IPSec on Windows XP SP2

1. Download the Windows XP SP Support Tools. (must be the SP2 version)
2. Install the Support Tools.  I choose the "complete" install option, but it may not matter.
3. Review how the ipseccmd.exe command works.  Note - I think the help offered by "/?" is inaccurate as the 1f option works, yet doesn't display at the command line.
4. Either build your own script or choose one of mine.  Only one can work at a time.
   1. Notes: 
      • You must run the same script on all XP computers you want to use that IPSec between.
      • All my scripts allow ICMP unhindered to facilitate troubleshooting.
      • Make sure you edit my script to customize the shared secret used from "PresharedKeyString" to something else.
      • Dynamic scripts will only work until the next reboot or IPSec service restart.  This allows you to make temporary changes to IPSec. Safer for testing out IPSec
      • Static scripts will stay running at all times.  The only way to disable it is to open the IPSec console (via MMC) and disable the policy.  True secure modes of IPSec.
   2. Optional IPSec scripts (don't force IPSec usage, just try to use it)
      1. Dynamic or static encryption. Related IPSec policy file for static.
      2. Dynamic or static authentication.  Related IPSec policy file for static.
   3. Required IPSec scripts (force IPSec usage, drop non-IPSec connections)
      1. Dynamic or static encryption.  Related IPSec policy file for static.
      2. Dynamic or static authentication.  Related IPSec policy file for static.